Use terraform to config GCP proxy setup

With terraform (https://terraform.io) we can convert most of the infrastructure setup into code. This simplifies setting up a new proxy as well as providing reproducibility in the setup, eliminating human errors as much as possible.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=190634711

java/google/registry/proxy/terraform/example_config.tf

@@ -0,0 +1,35 @@
+terraform {
+  backend "gcs" {
+    # The name of the GCS bucket that stores the terraform.tfstate file.
+    bucket = "YOUR_GCS_BUCKET"
+    prefix = "terraform/state"
+  }
+}
+
+module "proxy" {
+  source = "../../modules"
+  proxy_project_name = "YOUR_PROXY_PROJECT"
+  nomulus_project_name = "YOUR_NOMULUS_GPROJECT"
+  gcr_project_name = "YOUR_GCR_PROJECT"
+  proxy_domain_name = "YOUR_PROXY_DOMAIN"
+}
+
+output "proxy_service_account_client_id" {
+  value = "${module.proxy.proxy_service_account_client_id}"
+}
+
+output "proxy_name_servers" {
+  value = "${module.proxy.proxy_name_servers}"
+}
+
+output "proxy_instance_groups" {
+  value = "${module.proxy.proxy_instance_groups}"
+}
+
+output "proxy_ip_addresses" {
+  value = {
+    ipv4 = "${module.proxy.proxy_ipv4_address}",
+    ipv6 = "${module.proxy.proxy_ipv6_address}"
+  }
+}
+

java/google/registry/proxy/terraform/modules/common.tf

@@ -0,0 +1,3 @@
+provider "google" {
+  project = "${var.proxy_project_name}"
+}

java/google/registry/proxy/terraform/modules/dns.tf

@@ -0,0 +1,36 @@
+resource "google_dns_managed_zone" "proxy_domain" {
+  name = "proxy-domain"
+  dns_name = "${var.proxy_domain_name}."
+}
+
+resource "google_dns_record_set" "proxy_epp_a_record" {
+  name = "epp.${google_dns_managed_zone.proxy_domain.dns_name}"
+  type = "A"
+  ttl  = 300
+  managed_zone = "${google_dns_managed_zone.proxy_domain.name}"
+  rrdatas = ["${google_compute_global_address.proxy_ipv4_address.address}"]
+}
+
+resource "google_dns_record_set" "proxy_epp_aaaa_record" {
+  name = "epp.${google_dns_managed_zone.proxy_domain.dns_name}"
+  type = "AAAA"
+  ttl  = 300
+  managed_zone = "${google_dns_managed_zone.proxy_domain.name}"
+  rrdatas = ["${google_compute_global_address.proxy_ipv6_address.address}"]
+}
+
+resource "google_dns_record_set" "proxy_whois_a_record" {
+  name = "whois.${google_dns_managed_zone.proxy_domain.dns_name}"
+  type = "A"
+  ttl  = 300
+  managed_zone = "${google_dns_managed_zone.proxy_domain.name}"
+  rrdatas = ["${google_compute_global_address.proxy_ipv4_address.address}"]
+}
+
+resource "google_dns_record_set" "proxy_whois_aaaa_record" {
+  name = "whois.${google_dns_managed_zone.proxy_domain.dns_name}"
+  type = "AAAA"
+  ttl  = 300
+  managed_zone = "${google_dns_managed_zone.proxy_domain.name}"
+  rrdatas = ["${google_compute_global_address.proxy_ipv6_address.address}"]
+}

java/google/registry/proxy/terraform/modules/gke.tf

@@ -0,0 +1,32 @@
+module "proxy_gke_americas" {
+  source = "./gke"
+  proxy_cluster_region = "americas"
+  proxy_service_account_email = "${google_service_account.proxy_service_account.email}"
+  proxy_ports = "${var.proxy_ports}"
+}
+
+module "proxy_gke_emea" {
+  source = "./gke"
+  proxy_cluster_region = "emea"
+  proxy_service_account_email = "${google_service_account.proxy_service_account.email}"
+  proxy_ports = "${var.proxy_ports}"
+}
+
+module "proxy_gke_apac" {
+  source = "./gke"
+  proxy_cluster_region = "apac"
+  proxy_service_account_email = "${google_service_account.proxy_service_account.email}"
+  proxy_ports = "${var.proxy_ports}"
+}
+
+locals {
+  "proxy_instance_groups" = {
+    americas = "${module.proxy_gke_americas.proxy_instance_group}",
+    emea = "${module.proxy_gke_emea.proxy_instance_group}",
+    apac = "${module.proxy_gke_apac.proxy_instance_group}",
+  }
+}
+
+output "proxy_instance_groups" {
+  value = "${local.proxy_instance_groups}"
+}

java/google/registry/proxy/terraform/modules/gke/cluster.tf

@@ -0,0 +1,37 @@
+locals {
+  proxy_cluster_zone = "${lookup(var.proxy_cluster_zones, var.proxy_cluster_region)}"
+}
+
+data "google_container_engine_versions" "gke_version" {
+  zone = "${local.proxy_cluster_zone}"
+}
+
+resource "google_container_cluster" "proxy_cluster" {
+  name = "proxy-cluster-${var.proxy_cluster_region}"
+  zone = "${local.proxy_cluster_zone}"
+  node_version = "${data.google_container_engine_versions.gke_version.latest_node_version}"
+  min_master_version = "${data.google_container_engine_versions.gke_version.latest_master_version}"
+
+  node_pool {
+    name = "proxy-node-pool"
+    initial_node_count = 1
+    node_config {
+      tags = [
+        "proxy-cluster"]
+      service_account = "${var.proxy_service_account_email}"
+      oauth_scopes = [
+        "https://www.googleapis.com/auth/cloud-platform",
+        "https://www.googleapis.com/auth/userinfo.email"
+      ]
+    }
+    autoscaling {
+      max_node_count = 5
+      min_node_count = 1
+    }
+    management {
+      auto_repair = true
+      auto_upgrade = true
+    }
+  }
+}
+

java/google/registry/proxy/terraform/modules/gke/input.tf

@@ -0,0 +1,16 @@
+variable "proxy_service_account_email" {}
+
+variable "proxy_cluster_region" {}
+
+variable "proxy_cluster_zones" {
+  type = "map"
+  default = {
+    americas = "us-east4-a"
+    emea = "europe-west4-b"
+    apac = "asia-northeast1-c"
+  }
+}
+
+variable "proxy_ports" {
+  type = "map"
+}

java/google/registry/proxy/terraform/modules/gke/output.tf

@@ -0,0 +1,3 @@
+output "proxy_instance_group" {
+  value = "${google_container_cluster.proxy_cluster.instance_group_urls[0]}"
+}

java/google/registry/proxy/terraform/modules/iam.tf

@@ -0,0 +1,26 @@
+resource "google_service_account" "proxy_service_account" {
+  account_id = "proxy-service-account"
+  display_name = "Nomulus proxy service account"
+}
+
+resource "google_project_iam_member" "nomulus_project_viewer" {
+  project = "${var.nomulus_project_name}"
+  role = "roles/viewer"
+  member = "serviceAccount:${google_service_account.proxy_service_account.email}"
+}
+
+resource "google_project_iam_member" "gcr_storage_viewer" {
+  project = "${var.gcr_project_name}"
+  role = "roles/storage.objectViewer"
+  member = "serviceAccount:${google_service_account.proxy_service_account.email}"
+}
+
+resource "google_project_iam_member" "metric_writer" {
+  role = "roles/monitoring.metricWriter"
+  member = "serviceAccount:${google_service_account.proxy_service_account.email}"
+}
+
+resource "google_project_iam_member" "log_writer" {
+  role = "roles/logging.logWriter"
+  member = "serviceAccount:${google_service_account.proxy_service_account.email}"
+}

java/google/registry/proxy/terraform/modules/input.tf

@@ -0,0 +1,31 @@
+# GCP project in which the proxy runs.
+variable "proxy_project_name" {}
+
+# GCP project in which Nomulus runs.
+variable "nomulus_project_name" {}
+
+# GCP project from which the proxy image is pulled.
+variable "gcr_project_name" {}
+
+# The base domain name of the proxy, without the whois. or epp. part.
+variable "proxy_domain_name" {}
+
+# Cloud KMS keyring name
+variable "proxy_key_ring" {
+  default = "proxy-key-ring"
+}
+
+# Cloud KMS key name
+variable "proxy_key" {
+  default = "proxy-key"
+}
+
+# Node ports exposed by the proxy.
+variable "proxy_ports" {
+  type = "map"
+  default = {
+    health_check = 30000
+    whois = 30001
+    epp = 30002
+  }
+}

java/google/registry/proxy/terraform/modules/kms.tf

@@ -0,0 +1,16 @@
+resource "google_kms_key_ring" "proxy_key_ring" {
+  name = "${var.proxy_key_ring}"
+  location = "global"
+}
+
+resource "google_kms_crypto_key" "proxy_key" {
+  name = "${var.proxy_key}"
+  key_ring = "${google_kms_key_ring.proxy_key_ring.id}"
+}
+
+resource "google_kms_crypto_key_iam_member" "ssl_key_decrypter" {
+  crypto_key_id = "${google_kms_crypto_key.proxy_key.id}"
+  role = "roles/cloudkms.cryptoKeyDecrypter"
+  member = "serviceAccount:${google_service_account.proxy_service_account.email}"
+}
+

java/google/registry/proxy/terraform/modules/networking.tf

@@ -0,0 +1,116 @@
+resource "google_compute_global_address" "proxy_ipv4_address" {
+  name = "proxy-ipv4-address"
+  ip_version = "IPV4"
+}
+
+resource "google_compute_global_address" "proxy_ipv6_address" {
+  name = "proxy-ipv6-address"
+  ip_version = "IPV6"
+}
+
+resource "google_compute_firewall" "proxy_firewall" {
+  name = "proxy-firewall"
+  network = "default"
+
+  allow {
+    protocol = "tcp"
+    ports = [
+      "${var.proxy_ports["epp"]}",
+      "${var.proxy_ports["whois"]}",
+      "${var.proxy_ports["health_check"]}"]
+  }
+
+  source_ranges = [
+    "130.211.0.0/22",
+    "35.191.0.0/16"]
+
+  target_tags = [
+    "proxy-cluster"
+  ]
+}
+
+resource "google_compute_health_check" "proxy_health_check" {
+  name = "proxy-health-check"
+
+  tcp_health_check {
+    port = "${var.proxy_ports["health_check"]}"
+    request = "HEALTH_CHECK_REQUEST"
+    response = "HEALTH_CHECK_RESPONSE"
+  }
+}
+
+resource "google_compute_backend_service" "epp_backend_service" {
+  name = "epp-backend-service"
+  protocol = "TCP"
+  timeout_sec = 3600
+  port_name = "epp"
+  backend {
+    group = "${local.proxy_instance_groups["americas"]}"
+  }
+  backend {
+    group = "${local.proxy_instance_groups["emea"]}"
+  }
+  backend {
+    group = "${local.proxy_instance_groups["apac"]}"
+  }
+  health_checks = [
+    "${google_compute_health_check.proxy_health_check.self_link}"]
+}
+
+resource "google_compute_backend_service" "whois_backend_service" {
+  name = "whois-backend-service"
+  protocol = "TCP"
+  timeout_sec = 60
+  port_name = "whois"
+  backend {
+    group = "${local.proxy_instance_groups["americas"]}"
+  }
+  backend {
+    group = "${local.proxy_instance_groups["emea"]}"
+  }
+  backend {
+    group = "${local.proxy_instance_groups["apac"]}"
+  }
+  health_checks = [
+    "${google_compute_health_check.proxy_health_check.self_link}"]
+}
+
+resource "google_compute_target_tcp_proxy" "epp_tcp_proxy" {
+  name = "epp-tcp-proxy"
+  proxy_header = "PROXY_V1"
+  backend_service = "${google_compute_backend_service.epp_backend_service.self_link}"
+}
+
+resource "google_compute_target_tcp_proxy" "whois_tcp_proxy" {
+  name = "whois-tcp-proxy"
+  proxy_header = "PROXY_V1"
+  backend_service = "${google_compute_backend_service.whois_backend_service.self_link}"
+}
+
+resource "google_compute_global_forwarding_rule" "epp_ipv4_forwarding_rule" {
+  name = "epp-ipv4-forwarding-rule"
+  ip_address = "${google_compute_global_address.proxy_ipv4_address.address}"
+  target = "${google_compute_target_tcp_proxy.epp_tcp_proxy.self_link}"
+  port_range = "700"
+}
+
+resource "google_compute_global_forwarding_rule" "epp_ipv6_forwarding_rule" {
+  name = "epp-ipv6-forwarding-rule"
+  ip_address = "${google_compute_global_address.proxy_ipv6_address.address}"
+  target = "${google_compute_target_tcp_proxy.epp_tcp_proxy.self_link}"
+  port_range = "700"
+}
+
+resource "google_compute_global_forwarding_rule" "whois_ipv4_forwarding_rule" {
+  name = "whois-ipv4-forwarding-rule"
+  ip_address = "${google_compute_global_address.proxy_ipv4_address.address}"
+  target = "${google_compute_target_tcp_proxy.whois_tcp_proxy.self_link}"
+  port_range = "43"
+}
+
+resource "google_compute_global_forwarding_rule" "whois_ipv6_forwarding_rule" {
+  name = "whois-ipv6-forwarding-rule"
+  ip_address = "${google_compute_global_address.proxy_ipv6_address.address}"
+  target = "${google_compute_target_tcp_proxy.whois_tcp_proxy.self_link}"
+  port_range = "43"
+}

java/google/registry/proxy/terraform/modules/output.tf

@@ -0,0 +1,15 @@
+output "proxy_name_servers" {
+  value = "${google_dns_managed_zone.proxy_domain.name_servers}"
+}
+
+output "proxy_service_account_client_id" {
+  value = "${google_service_account.proxy_service_account.unique_id}"
+}
+
+output "proxy_ipv4_address" {
+  value = "${google_compute_global_address.proxy_ipv4_address.address}"
+}
+
+output "proxy_ipv6_address" {
+  value = "${google_compute_global_address.proxy_ipv6_address.address}"
+}

java/google/registry/proxy/terraform/update_named_ports.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Copyright 2018 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Terraform currently cannot set named ports on the instance groups underlying
+# the gke instances it creates. Here we output the instance group URL, extract
+# the project, zone and instance group names, and then call gcloud to add the
+# named ports.
+
+terraform output proxy_instance_groups | awk '{print $3}' | \
+  awk -F '/' '{print "--project", $7, "--zone", $9, $11}' |
+{
+  while read line
+  do
+    gcloud compute instance-groups set-named-ports \
+      --named-ports whois:30001,epp:30002 $line
+  done
+}